Web-terminal: Rechteeskaltation über übermäßige /etc/passwd Berechtigungen

The primary impact of CVE-2025-57853 is the potential for an attacker to escalate their privileges to root within a container. This allows them to execute arbitrary commands with the highest level of access, effectively taking control of the container's environment. An attacker could then access sensitive data stored within the container, modify system configurations, or even use the compromised container as a launchpad for lateral movement within the broader infrastructure. The blast radius extends to any data or services hosted within the affected container. While the vulnerability requires command execution within the container, the ease of achieving this in some scenarios makes it a significant risk, particularly in environments where containers are used to host critical applications or sensitive data.

Organizations deploying Red Hat Web Terminal in containerized environments, particularly those using older versions (1.0.0–2.5.3), are at risk. Shared hosting environments where multiple users share a container are especially vulnerable, as an attacker could potentially compromise the entire container.

• linux / server:

find / -name /etc/passwd -perm -g+w

• linux / server:

journalctl -u web-terminal | grep -i privilege

• linux / server:

ps aux | grep web-terminal

1. 2026-04-08Disclosure

   disclosure

1. Reserviert2025-08-21
2. Veröffentlicht2026-04-08
3. EPSS aktualisiert2026-04-16

The primary mitigation for CVE-2025-57853 is to upgrade Red Hat Web Terminal to version 2.5.4 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. Restrict access to the container to only authorized users and processes. Implement strict container resource limits to minimize the potential impact of a successful exploit. Monitor container logs for suspicious activity, particularly attempts to modify the /etc/passwd file. Consider using a Web Application Firewall (WAF) or reverse proxy to filter traffic and block malicious requests. After upgrading, verify the fix by attempting to create a new user with UID 0 within a container running the patched version; this should fail.